Privacy Policy

This Privacy Policy explains what information Fibby Ninja collects, how we use it, and the choices you have. It applies to the Fibby Ninja web application and MCP (Model Context Protocol) connector (together, the "Service"). If you are an accounting firm connecting a client's books, see also our Data Processing Addendum for the roles and obligations around that client data.

Account and profile information: name, work email, firm name, and basic profile details you provide when you sign up or that your firm administrator provides when inviting you.

Accounting-platform connection data: when you connect QuickBooks Online (or another supported platform), we store the OAuth access and refresh tokens needed to call that platform's API on your behalf. These tokens are encrypted at rest using AES-256-GCM before being stored; we do not store your QuickBooks password, since the connection is made through Intuit's own OAuth flow.

Financial data accessed through the connected accounting platform: when your AI client (Claude, ChatGPT, etc.) asks a question through the Service, we call the accounting platform's API in real time to retrieve the data needed to answer it. We are not building a permanent copy of your general ledger — data retrieved to answer a query, generate a report, or support short-term caching for performance is retained only as long as reasonably needed for those purposes (see "Data Retention" below), not duplicated indefinitely as a separate data warehouse.

Uploaded documents: if you or a client upload supporting documents (e.g., receipts, statements) through an upload link, those files are stored in our file storage so they can be reviewed and attached to the relevant accounting records.

Usage and audit logs: we log account activity, connection and access-grant changes, and tool calls made through the MCP connector (e.g., which tool was called, by which user, for which connected company, and when) for security, troubleshooting, and audit purposes.

We use the information above to:

• Operate, maintain, and secure the Service, including authenticating users and enforcing per-firm access controls;
• Retrieve and return the accounting data needed to answer a query made through your AI client;
• Send account-related communications (e.g., verification emails, invitations, security alerts);
• Investigate misuse, enforce our Terms of Service, and maintain audit trails for your firm's administrators; and
• Improve the reliability and functionality of the Service.

We do not sell your personal information or your clients' financial data, and we do not use it to train third-party AI models.

We share information with the sub-processors and service providers that help us run the Service (such as our database/hosting providers), listed on our Sub-processors page. We may also disclose information if required by law, to protect our rights or the safety of users, or in connection with a merger, acquisition, or sale of assets (with notice to affected customers where required).

About AI clients: when you use Claude, ChatGPT, or another AI client with Fibby Ninja's MCP connector, that AI client is one you brought and configured yourself — it calls our MCP server directly using your own credentials, with the scope of data you're authorized to see. Fibby Ninja does not separately send your data to Anthropic, OpenAI, or any other AI provider; we are not a party to your relationship or agreement with those providers, and this Policy does not govern their handling of data once it reaches your AI client.

We retain account and connection data for as long as your account is active, and for a reasonable period afterward to comply with legal obligations, resolve disputes, and enforce our agreements. Audit logs and tool-call records are retained to support security investigations and compliance needs. You can request deletion of your account data as described in "Your Rights" below.

We apply technical and organizational measures appropriate to the sensitivity of financial data, including:

• Encryption at rest: QuickBooks OAuth tokens are encrypted using AES-256-GCM before being stored.
• Encryption in transit: all connections to the Service use TLS/HTTPS.
• Multi-tenant isolation: Postgres row-level security policies scope every query to the authenticated user's own firm, so one firm's data is not visible to another.
• Multi-factor authentication: we support TOTP-based two-factor authentication on user accounts.
• Audit logging: administrative actions, access-grant changes, and MCP tool calls are logged.
• Security headers and rate limiting on our web application and API.

See our Security page for more detail.

Depending on where you're located, you may have rights to access, correct, export, or delete your personal information, and to object to or restrict certain processing (for example, under the GDPR in the EU/UK, or the CCPA/CPRA in California, and similar laws elsewhere). Firm administrators can access and export most account and connection data directly from the Service; you can also contact us using the details below to make a request, and we will respond within the timeframe required by applicable law.

If your firm has connected your company's QuickBooks data on your behalf, requests about that data may need to go through your firm, since they control the connection.

We use strictly necessary cookies to keep you signed in and to protect the Service (e.g., session and CSRF-related cookies). We do not currently use third-party advertising or cross-site tracking cookies.

The Service is intended for business use by adults acting on behalf of an accounting firm or business. It is not directed to children under 18, and we do not knowingly collect personal information from children.

Our infrastructure providers may process and store data in the United States or other countries. Where we transfer personal data internationally, we aim to use appropriate safeguards (such as Standard Contractual Clauses) as required by applicable law; see our Data Processing Addendum for detail relevant to customer and client data.

We may update this Privacy Policy from time to time. We will update the "Last updated" date above and, for material changes, provide more prominent notice.

Questions about this Privacy Policy, or requests regarding your personal information, can be sent to hello@fibby.ninja.